Product Update · Privacy Engineering

How We Built a Privacy-First Admin Dashboard That Counts Redirects Without Tracking Anyone

Published April 2026 · 8 min read · By the TraceNull Team

When you run a URL shortener, you need visibility. How many links are being clicked? Is the service growing? Are short links more popular than direct /go redirects? These are fundamental operational questions — and most platforms answer them by vacuuming up every scrap of user data they can find.

We just shipped a new admin statistics dashboard for TraceNull. It separates /go referrer-strip redirects from short-link clicks, shows active short-link counts, and breaks traffic down by today, 7 days, 30 days, and the full year. And it does all of this without storing a single IP address, fingerprint, or user identifier.

Here's exactly how — and why the distinction between redirect types matters more than you'd think.

Why Separate /go Redirects From Short-Link Clicks?

TraceNull serves two distinct functions that often get blurred together:

Referrer-stripping redirects (/go?url=) — Anyone can paste a URL into TraceNull and get an instant, referrer-stripped redirect. No account needed. No short link created. The destination never sees where the visitor came from.
Short-link clicks — Users create shortened URLs (like tracenull.cc/Xk9m) that redirect to a destination. These also strip referrer headers, but they persist as reusable links with optional analytics, passwords, QR codes, and UTM parameters.

From an operational standpoint, these are completely different usage patterns. A spike in /go redirects might mean a popular forum or community discovered TraceNull's referrer-stripping feature. A spike in short-link clicks might mean a Business customer launched a new campaign. Lumping them together would make the data meaningless.

Key insight: Useful analytics don't require granular user data. Aggregate counters — split by the right dimensions — often tell you more than a firehose of individual tracking events.

The Architecture: Counters, Not Profiles

Most analytics systems work by recording individual events: "User A clicked link B at time C from IP D with browser E." Then they aggregate later. This creates a treasure trove of personal data that's a liability under GDPR, a target for breaches, and fundamentally at odds with a privacy-first mission.

TraceNull's approach is the inverse. We increment counters. That's it.

The Data Model

Our SQLite database stores aggregate counts, not event logs. When a redirect happens, we update simple counter rows:

-- Simplified schema concept
-- No IP addresses. No user agents. No timestamps per click.

redirect_stats (
  stat_date    TEXT,    -- e.g. '2026-04-26'
  type         TEXT,    -- 'go_redirect' or 'short_click'
  count        INTEGER  -- incremented atomically
)

When a /go request comes in, we increment the go_redirect counter for today's date. When a short link is clicked, we increment short_click. There is no way to reconstruct individual visits from this data because individual visits were never recorded.

The Admin Stats Tab

The new Stats tab in the admin panel presents four time windows:

Time Window	What It Shows
Today	Redirects and short-link clicks since midnight UTC
7 Days	Rolling week totals for both types
30 Days	Rolling month totals
Year	Rolling 365-day totals

Each window displays /go redirects and short-link clicks as separate numbers, plus a combined total. We also added an active shorts count — the number of short links that haven't expired yet — so operators can see how many links are currently live across all tiers.

Three Engineering Decisions That Protect Privacy

1. No Event Log, Period

The most common "privacy-friendly" analytics approach is to collect events but strip identifying information before storage. This is better than nothing, but it's fragile. A code change, a misconfigured log level, or a well-intentioned debugging session can accidentally reintroduce PII.

TraceNull doesn't have an event log to sanitize. The count++ operation is the only write that happens on a redirect. There's nothing to leak because nothing was collected.

2. Date-Level Granularity Only

We deliberately chose daily granularity instead of hourly or per-minute. Finer time resolution can enable correlation attacks — if you know someone clicked a link at 14:32:07, and the analytics show exactly one click at 14:32, you've effectively de-anonymized that data point. Daily buckets make this kind of correlation orders of magnitude harder.

A common mistake: Many "privacy-first" tools offer per-minute or per-second analytics while claiming they don't track users. High-resolution timestamps are a form of tracking — they're just indirect. Be skeptical of services that offer both granular time data and a "no tracking" promise.

3. Admin-Only Access With No Client-Side Analytics

The stats dashboard is server-rendered and lives behind admin authentication. There's no client-side JavaScript analytics library, no pixel, no beacon. Visitors to TraceNull — both the landing page and the redirect endpoints — never execute third-party analytics code. The counter increment happens entirely server-side in the Node.js request handler, before the redirect response is sent.

// Pseudocode: what happens on a /go redirect
app.get('/go', async (req, res) => {
  const url = req.query.url;
  if (!isValidUrl(url)) return res.status(400).send('Invalid URL');

  // Increment the daily counter — no IP, no UA, no referer stored
  await db.run(
    `INSERT INTO redirect_stats (stat_date, type, count)
     VALUES (date('now'), 'go_redirect', 1)
     ON CONFLICT(stat_date, type)
     DO UPDATE SET count = count + 1`
  );

  // Three-layer referrer stripping
  res.setHeader('Referrer-Policy', 'no-referrer');
  // Caddy also sets the header at the reverse-proxy level
  // The HTML meta tag provides a third layer as fallback
  res.redirect(303, url);
});

What About the Business Plan Analytics?

TraceNull's Business plan offers per-link click analytics. How does that square with the "no tracking" philosophy? The same way: per-link daily counters. Business users can see that their link tracenull.cc/Ab got 342 clicks this week. They cannot see who clicked, from where, or with what device. There are no referrer logs, no geo breakdowns, no device fingerprints.

This is by design. Affiliate marketers and campaign managers need to know if a link is working, not who is clicking it. "Did this campaign drive traffic?" is answered by a counter. "Which specific users engaged?" is a surveillance question — and it's not one TraceNull will ever answer.

Lessons for Privacy-First Product Design

Building this dashboard reinforced a few principles that apply far beyond URL shorteners:

Start with the minimum data that answers your question. We needed to know redirect volume trends. A single integer per day per type answers that completely.
Separate your dimensions early. Splitting /go from short-link traffic was a one-line change at ingestion time but would have been impossible to reconstruct retroactively from a combined counter.
Make the privacy-invasive path harder than the private path. Our schema doesn't have columns for IP or user agent. Adding tracking would require a migration. The path of least resistance is the private path.
Audit your time resolution. Every increase in temporal granularity is a potential de-anonymization vector. Choose the coarsest resolution that still answers your operational questions.

The bottom line: You can run a production service, understand your traffic patterns, separate different redirect types, monitor growth, and make data-informed decisions — all with nothing more than a few integer counters bucketed by date. The surveillance-industrial complex has convinced us that useful analytics require invasive tracking. They don't.

What's Next

The admin stats tab is live and powering our operational decisions today. In future updates, we're exploring:

Trend indicators — simple up/down arrows comparing this period to the last, still derived from aggregate counters
Anomaly alerts — notifications if redirect volume drops to zero (likely a service issue) or spikes abnormally (possible abuse)
Public transparency stats — a public page showing total redirects served, reinforcing our commitment to openness about operations while staying opaque about users

All of these features will follow the same principle: count events, not people.

Try TraceNull Today

Strip referrer headers from any link instantly — no signup required. Or create a free short link with 4-character slugs. Need campaign analytics, custom domains, and API access? Check out our Business plan.

Get Started Free